Endpoint to post a token

i think this behavior shouldn't be exposed internally